fix can access graph of any users without credentials